2026-08-08_903d1eb8855501108c1a5a3063cab102_amadey_avoslocker_coinminer_darkgate_elex_luca-stealer_lynx_magniber_njrat

General

Target
2026-08-08_903d1eb8855501108c1a5a3063cab102_amadey_avoslocker_coinminer_darkgate_elex_luca-stealer_lynx_magniber_njrat
Size 4.4MB
Sample260808-dnfwrsyfnd
SHA256 951cde84a20b674b9a6379c450096e5265ee487683a6d44d1bbe150c30e1f0d3
MD5 903d1eb8855501108c1a5a3063cab102
SHA1 27c2d2d254590feb3771c0d88f889a7d138370b4
SHA512 e81c94dc2670118e9b6adae577067fd1acfcca98761aef88d9fa7ab8dd0d378358acd40a07bceacdb2ab9f8c3916c1c4017c8fc69aeab7e5b9542f82aa4c7caf
SSDEEP 98304:tEjMTXAwkVmf816+A+by0kyJsoGvoH7eFEc:tEjMTQwkVm01QT0pGvTC
TLSH
T11B26BF11770FC166E65102702A2D6B2B92BEBAB65F3642C3F3D42A5D0D612D36B35F23
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-08_903d1eb8855501108c1a5a3063cab102_amadey_avoslocker_coinminer_darkgate_elex_luca-stealer_lynx_magniber_njrat

File Explorer

2026-08-08_903d1eb8855501108c1a5a3063cab102_amadey_avoslocker_coinminer_darkgate_elex_luca-stealer_lynx_magniber_njrat

.exe 4.4MB

2026-08-08_903d1eb8855501108c1a5a3063cab102_amadey_avoslocker_coinminer_darkgate_elex_luca-stealer_lynx_magniber_njrat

IMPHASH 3ec7467fc46065a814e637c4f846d599
SHA256 951cde84a20b674b9a6379c450096e5265ee487683a6d44d1bbe150c30e1f0d3
MD5 903d1eb8855501108c1a5a3063cab102
SHA1 27c2d2d254590feb3771c0d88f889a7d138370b4
SHA512 e81c94dc2670118e9b6adae577067fd1acfcca98761aef88d9fa7ab8dd0d378358acd40a07bceacdb2ab9f8c3916c1c4017c8fc69aeab7e5b9542f82aa4c7caf
SSDEEP 98304:tEjMTXAwkVmf816+A+by0kyJsoGvoH7eFEc:tEjMTQwkVm01QT0pGvTC
TLSH
T11B26BF11770FC166E65102702A2D6B2B92BEBAB65F3642C3F3D42A5D0D612D36B35F23
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

1997725

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

H:\pub_1ikas\rc_bugfix_master_\Build\Release\WPSOffice\office6\KUninstall.pdb

kernel32

VirtualAlloc VirtualFree IsProcessorFeaturePresent GetVersionExW EnterCriticalSection LeaveCriticalSection DeleteCriticalSection CloseHandle GetLastError InitializeCriticalSection SetEvent ResetEvent ReleaseSemaphore WaitForSingleObject CreateEventW CreateSemaphoreW ResumeThread SetThreadAffinityMask CreateFileW FindClose FindFirstFileW FindNextFileW GetFileAttributesW DecodePointer RaiseException HeapDestroy HeapAlloc HeapReAlloc HeapFree HeapSize GetProcessHeap InitializeCriticalSectionAndSpinCount lstrlenW GetFileSize FindResourceExW LoadResource LockResource SizeofResource FindResourceW CreateDirectoryW DeleteFileW SetEndOfFile SetFilePointer SetFilePointerEx WriteFile Sleep GetTickCount GetSystemDirectoryW CreateFileMappingW MapViewOfFile UnmapViewOfFile CopyFileW MoveFileExW GetStdHandle ReadFile MultiByteToWideChar WideCharToMultiByte SetCurrentDirectoryW GetCurrentDirectoryW RemoveDirectoryW SetFileAttributesW GetTempPathW SetLastError GetCurrentProcessId GetCurrentThreadId GetWindowsDirectoryW GetModuleHandleW GetProcAddress MoveFileW GetModuleHandleA CompareFileTime GetCurrentProcess GetSystemInfo GlobalMemoryStatus GetProcessAffinityMask VerSetConditionMask VerifyVersionInfoW FreeLibrary LoadLibraryExW GetPrivateProfileStringW QueryPerformanceCounter QueryPerformanceFrequency CreateMutexW OpenMutexW GetExitCodeProcess CreateProcessW LocalFree ExpandEnvironmentStringsW GetFileAttributesExW TerminateProcess OpenProcess GetSystemWow64DirectoryW LoadLibraryW lstrcmpW FreeResource GlobalAlloc GlobalUnlock GlobalLock GlobalFree WritePrivateProfileStringW ReleaseMutex OpenEventW OpenFileMappingW GetCurrentThread GetDateFormatW GetTimeFormatW ReadProcessMemory CreateToolhelp32Snapshot Process32FirstW Process32NextW CreateThread GetLocalTime GetEnvironmentVariableW SetEnvironmentVariableW FileTimeToLocalFileTime GetLongPathNameW QueryDosDeviceW ProcessIdToSessionId GetModuleFileNameW FileTimeToSystemTime WaitForMultipleObjects OutputDebugStringW GetNativeSystemInfo IsWow64Process GetPrivateProfileIntW GetCommandLineW MapViewOfFileEx lstrcmpiW TerminateThread GetLocaleInfoW GetUserDefaultUILanguage GetModuleHandleExW SetErrorMode DeviceIoControl WTSGetActiveConsoleSessionId GetFileSizeEx GetSystemTime SystemTimeToTzSpecificLocalTime SystemTimeToFileTime GetFullPathNameW CreateFileA OpenThread SetThreadPriority GetThreadPriority SuspendThread GetThreadContext FlushInstructionCache VirtualProtect VirtualQuery VirtualProtectEx OutputDebugStringA GetEnvironmentStringsW LoadLibraryExA WaitForSingleObjectEx UnhandledExceptionFilter SetUnhandledExceptionFilter InitializeSListHead GetSystemTimeAsFileTime IsDebuggerPresent GetStartupInfoW FormatMessageA GetStringTypeW InitializeSRWLock ReleaseSRWLockExclusive AcquireSRWLockExclusive InitializeCriticalSectionEx TryEnterCriticalSection FindFirstFileExW AreFileApisANSI GetFileInformationByHandleEx InitOnceBeginInitialize InitOnceComplete ReleaseSRWLockShared AcquireSRWLockShared EncodePointer LCMapStringEx CompareStringEx GetCPInfo GetLocaleInfoEx InterlockedPopEntrySList InterlockedPushEntrySList RtlUnwind TlsAlloc TlsGetValue TlsSetValue TlsFree ExitProcess ExitThread FreeLibraryAndExitThread GetCommandLineA GetFileType WriteConsoleW CompareStringW LCMapStringW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW FlushFileBuffers GetConsoleCP GetConsoleMode GetTimeZoneInformation ReadConsoleW SetStdHandle IsValidCodePage GetACP GetOEMCP FreeEnvironmentStringsW

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-08_903d1eb8855501108c1a5a3063cab102_amadey_avoslocker_coinminer_darkgate_elex_luca-stealer_lynx_magniber_njrat

kernel32

generic